Question & Answer
This article contains common questions and answers for customers about QRadar licenses and how to get help with license issues. If you are looking information about QRadar on Cloud, go to the QRadar on Cloud: Support FAQ and common questions.
- What is Q1PD and how can they help with QRadar licenses?
Q1PD is the IBM team that handles license fulfillment for end users. The Q1PD team can provide copies of QRadar licenses, generate licenses for new customers, issue Event per Second (EPS) or Flow per Minute (FPM) license increases, or provide activation keys for QRadar systems at version prior to 7.3.0 to an end user or an IBM sales representative.
The Q1PD team can:Note: If you need to discuss a license renewal or purchase a license increase, start by contacting your IBM Sales Representative. Your sales representative can email the Q1PD team on your behalf to assist with communication and license fulfillment for your QRadar deployment. If you are a partner or have not purchased QRadar and need a renewed license key, see IBM Passport Advantage or download QRadar Community Edition.
- Generate replacement license keys for new appliance purchases or hardware migrations
- Generate licenses that have been lost from a previous purchase
- Generate licenses for purchased increases or renewals
- How to contact Q1PD and required information
Typically, the end user or the IBM Sales Representative will email the Security Licensing team ( Q1PD ) for license keys or regarding any simple license matters. Emails to the Q1PD team must include some form of identification in order to obtain a copy of the license keys for your QRadar products.
The following identification can be used to request license keys:
- IBM SAP Sales Order number. (Best)
- A copy of the Proof of Entitlement (POE) document. Proof of entitlement is emailed from Passport_Advantage@ibm.com with the subject IBM Passport Advantage Express Proof of Entitlement.
- A screen capture of the QRadar 'System and License Management' user interface. This should include the serial numbers for your appliances. To take a screen capture, open the Admin tab and click the System and License Management icon. From the Display drop-down, select Systems. Take a screen capture of the page and provide this information to the Q1PD team.
- A valid site ID or IBM Customer Number (ICN) (Minimum requirement)
Clients should be able to find their account identification information in their Passport Advantage Account, or on their Proof of Entitlement documentation. IBM Sales representatives can find information on their clients in FastPass. If needed, the Q1PD team can also look up this information by leveraging FastPass on behalf of the customer.
As a service for end users, QRadar administrators of the site contact for your account can contact your IBM Sales representative or a QRadar Support for assistance with license issues. Both the IBM sales representative or a QRadar Support representative can email email@example.com on your behalf for a copy of the license keys for your Console or other managed hosts. If you want to open a case to start a license investigation or troubleshooting, contact QRadar Support.
NOTE: Communication between Q1PD and end users is email-based. If you require phone support, contact QRadar Support.
- IBM SAP Sales Order number. (Best)
- Who receives these emails or how to update email contact information?
The primary contact listed on the account will be the recipient for emails from the Q1PD team. Q1PD cannot assist with updating the primary client account information. The primary account holder should be able to update information through their account, otherwise the Passport Advantage team must be leveraged to make changes.
- Where to find QRadar serial numbers for hardware, VMs, or software installations?
- Hardware serial numbers
Serial numbers for QRadar appliances can be found by querying the command line.
Where is this information?
From the command line of the Console, run:
- Software and virtual appliance serial numbers
QRadar software installations on your hardware and virtual serial numbers are assigned by Q1PD and can be found in the naming convention of the license key title beginning with either QCE or QRV. Administrators can review the LICENSE display view in the UI, which lists every host in the deployment, along with the title of the License Key file associated with each host.
Where is this information?
Open the Admin tab, click the System and License Management icon. From the Display drop-down, select Licenses. Take a screen capture of the page and provide this information to the Q1PD team.
- Hardware serial numbers
- What QRadar appliances need licenses?
In QRadar 7.3.0 and later, activation keys are no longer emailed to administrators as the software installation menu includes an appliance type list. The Q1PD team will send one license key for the primary Console appliance that contains the Event and Flow rates licensed for the deployment. All QRadar managed hosts, such as Event Processor or Flow Processor managed hosts can apply license allocations in the System and License Management interface.
As of QRadar 7.3.0, there are no longer individual Event or Flow Processor (16XX / 17XX / 18XX) License Keys provided. All new event and flow capacity increases are done using the Console License.
License keys are always required for the following add-on appliances as these appliances add new tabs and increase the functionality of the core QRadar SIEM product:
- QRadar Vulnerability Manager
- QRadar Risk Manager
- QRadar Network Insights.
- QRadar Incident Forensics
- About licenses and multi-Console deployments
The licensing pool is established per each Console deployment and will include the capacity for all of the events and flows for the managed hosts attached to a single Console. If you have a multi-Console deployment the event and flow rate is assigned to each Console and cannot be transferred or shared. Each Console in the deployment will have their own unique licensing pool to be allocated to hosts and multi-Console deployments cannot share a licensing pool as you cannot transfer license capacity from one Console to another.
At this time a multi-Console license infrastructure is not a feature of QRadar. Existing customers can request new features using the IBM Request for Enhancement system. For more information, see: QRadar: Request For Enhancements (RFE) and how to use them.
- How to request an activation key?
Activation keys can be provided by the Security Licensing team ( Q1PD ) for those running version 7.2.8 or earlier. In QRadar 7.3.x, clients are able to select their appliance from an installation menu without the need to request activation keys from the Security Licensing team ( Q1PD ).
Administrators who do not see their appliance listed in the installation menu in QRadar 7.3.0 or later should review the QRadar Hardware Guide. The list of available appliance types that can be installed using a QRadar ISO file is dependent on the hardware capability of the system QRadar is installing on. If the hardware capability of the appliance is not sufficient, the installation menu will not display certain appliance types. QRadar Support recommends that you review the QRadar Hardware Guide to determine what IBM capabilities are shipped on certain appliance types, then increase your hardware to meet the specifications of the physical appliances sold by IBM.
- Who to contact for license capacity questions?
- General questions
For questions on entitled capacity, clients should first contact their assigned IBM Sales Representative. Q1PD can assist with identifying capacity sent on previously sent license keys, or in validating specific license key orders were delivered.
- For license capacity increases
To purchase license capacity, clients should contact their assigned IBM Sales Representative. The IBM Sales representatives have access to a recommended sizing guidelines and can help you scope the required license capacity increase for your deployment.
- I ordered an event rate or flow license capacity increase, will I get an email from Q1PD?
Yes, if you ordered an EPS or Flow increase for your deployment, we will need their console license key serial number. We may need to reconcile their entire deployment, at which point, we will need the cumulative EPS and flow values. Once stackable licensing is launched (v7.3.2) & adopted by the client base, we will not need to reconcile the entire deployment.
- General questions
- I am on QRadar 7.2.x and I need more log source license limit. How does this work?
Prior to 2017, the standard base license for QRadar came with support for 750 log sources, and upgrades to that limit were available through additional purchases. In January of 2017, this limit was removed and upgrades are no longer a chargeable component.
Administrators are strongly encouraged to upgrade to the latest version of the software, where the log source limit is no longer enforced. This license change was released in QRadar 7.3.0 and later. If for some reason an administrator cannot update their QRadar deployment to 7.3.0 and needs their limit increased, a request can be sent to firstname.lastname@example.org and a new license with a raised limit will be dispatched.
- I need help with my log source license limit
If you are using QRadar 7.2.8 or earlier and unable to upgrade at this time, q1pd can assist with extending the log source limit associated to the Console license. A customer in this scenario should email email@example.com with the serial number of their primary 31XX AIO / Console. The Q1PD team can create a license that includes 9.9 Million log sources.
- I'm upgrading from QRadar 7.2.8 to QRadar 7.3.0 or 7.3.1. Do I need a new license to extend my log source limit?
No, administrators who are upgrading their QRadar software from 7.2.8 to 7.3.0 or later do not need to email the Security Licensing team ( Q1PD ) to receive an updated license. The upgrade should remove the restriction and users should not any issues related to log source license limits after upgrading.
If your software version is QRadar 7.3.0 or later and you are experiencing log source limit issues or System Notifications related to the log source license limit, you can contact QRadar Support for assistance as this system notification should not exist on QRadar 7.3.0 software versions. All new clients or new appliances at QRadar v7.3.0 or above should not face any issues related to log source license limits.
NOTE: QRadar Support always recommends that administrators upgrade to the latest version to avoid issues resolved is prior software releases.
- Can I contact Q1PD for QRadar Community Edition license updates?
No, QRadar Community Edition is a free product and includes a fixed event and flow license for 50 events per second and 5,000 flows per minute. QRadar Community Edition is a unique build of QRadar and this license cannot be increased, nor does it support any managed hosts.
Download QRadar Community Edition.
QRadar Community Edition limitations: QRadar Forums
- I am a Business Partner for IBM, how do I request a license for QRadar?
Authorized Business Partners can use the IBM Partner World portal to request a set of one-year activation/license keys to do software installations for the following products:For more information, see the following website: PartnerWorld.
- QRadar 31XX All-in-One SIEM (Software install & license key)
- QRadar Risk Manager (Software install & license key)
- QRadar Vulnerability Manager (Software install & license key)
- Data Node (Software install & license key)
- QRadar Incident Forensics (Software install & license key)
- I'm a Business Partner, but I do not have access to IBM Partner World.
For information on the IBM Software Access Catalog or questions related to Partner World offerings, see: http://www.ibm.com/partnerworld/wps/servlet/ContentHandler/isv/sac.
- I have a special use case and IBM Partner World is not appropriate, what do I do?
If the software access keys available through IBM Partner World are not appropriate for your use case, you can follow up with your IBM channels rep.
- I need further help, what should I do?
If there is a question or specific issue you want to discuss, users have the following options:
- QRadar Proof-of-Concept (POC) & QRadar Evaluation Programs (IBM Only)
After the pertinent request details are compiled, the POC manager is responsible for contacting the Security Licensing team ( Q1PD ) with a request to release License Keys. Only the POC Manager will be able to approve the release of POC Licenses.
For appliance projects, the license will be generated and delivered to your Sales Team upon delivery of the appliance. For Virtual projects the license will be generated based on the start date provided to the License team and delivered to your Sales Team.
Was this topic helpful?
04 November 2022